Panics observed during DF-2675 uid0-chain grooming (unprivileged readdir/reads
only; 3 separate boots; serial console captures):

1) msdosfs_readdir teardown fault (twice: v15/v18 grooming walks):
Fatal trap 12: page fault while in kernel mode
cpuid = 5; lapic id = 5
fault virtual address = 0xfffff8005b166000   (buffer-cache KVA)
instruction pointer = 0x8:0xffffffff8071cb57
current process = <chain> (unpriv)
Stopped at msdosfs_readdir+0x477: movzbl (%r13),%eax
=> readdir parsed an aliased directory slot whose PTE had been torn down
   (the neighbor's buffer recycled) -- the KVA alias fault class.

2) hammer2 flush corruption (v15 walk):
hammer2_base_delete() at hammer2_base_delete+0x32f
hammer2_flush_core() at hammer2_flush_core+0xaa2
hammer2_flush() at hammer2_flush+0x91
hammer2_xop_inode_flush() at hammer2_xop_inode_flush+0x93
hammer2_primary_xops_thread() at hammer2_primary_xops_thread+0x280
Debugger("panic")
=> a 17-page directory buffer's 17th PTE overwrote a live hammer2
   metadata buffer's page-0 PTE; hammer2 consumed foreign bytes as
   chain metadata; the next flush panicked.  Same class as the
   original finding's touch+sync panic (panic.txt).

3) Root-directory cache corruption (deget spam, 3 boots):
deget(): "." entry at clust 388 != 2   (x many)
=> the msdosfs root-dir buffer's cached page read through a clobbered
   PTE returning directory-cluster bytes; lookup paths degraded until
   the box wedged.